MOSS supports four more open source projects in Q3 2016 with $300k

Re:MOSS supports four more open source projects in Q3 2016 w... by hannob on Tuesday October 04, 2016 @07:54AM (#12634865)

Just skimmed through the zlib report.

Summary:

* They tested on binary level with CRS from Trail of Bits and on source level with TIS Interpreter from Pascal Cuoq.

* CRS found no bugs, TIS Interpreter found 5 from which they classified 4 as low and one as medium severity. All are C undefined behavior issues.

This doesn't necessarily mean CRS is bad, it may just mean that there are no bugs of the classes CRS finds in zlib.

Also notable that zlib hasn't released the fixes yet, they're just in the github repo. The last version is from 2013.

[ Parent | on HN ]

Re:MOSS supports four more open source projects in Q3 2016 w... by dguido on Tuesday October 04, 2016 @04:26PM (#12639158)

Close! tis-interpreter requires inputs to drive it, so we fed it inputs that the CRS generated, that AFL generated, and some existing test cases. tis-interpreter found 4 bugs and clang found 1.

> This doesn't necessarily mean CRS is bad, it may just mean that there are no bugs of the classes CRS finds in zlib.

Yes, exactly! This is why we included so much detail about coverage in the report. Basically, "stop looking for these kinds of bugs in these places, focus your efforts elsewhere in the code."

[ Parent | on HN ]